Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-08_38d52073fbc2f8d64d3f0d0ab70e6c13_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-08_38d52073fbc2f8d64d3f0d0ab70e6c13_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-08_38d52073fbc2f8d64d3f0d0ab70e6c13_mafia.exe
-
Size
488KB
-
MD5
38d52073fbc2f8d64d3f0d0ab70e6c13
-
SHA1
64b062b121514cd9bed8307381f7f7edd5a882b2
-
SHA256
80facc15568211d1a54b3d6fa797788c1fdc32655829ee462a9ab9f079fded65
-
SHA512
b387f2363469fc9fd182c2b70ccce79406f8f4bb46d0ea734ffe6c52d43b95bdece7c03d2de38161fc3b03d4bd64fadc7508e82cb85fd68c8b64112e74e5b6df
-
SSDEEP
12288:/U5rCOTeiD/B8Bq4iNamdbjfGeZhv2gMkNZ:/UQOJD/COdbjfGyrdN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2084 ED2C.tmp 2676 ED8A.tmp 2756 EE07.tmp 2948 EE74.tmp 2736 EED2.tmp 2812 EF2F.tmp 2764 EF9C.tmp 2548 F00A.tmp 2668 F077.tmp 2360 F0D4.tmp 2432 F132.tmp 2892 F19F.tmp 1112 F20C.tmp 2856 F27A.tmp 2308 F2D7.tmp 268 F344.tmp 2288 F3B2.tmp 672 F41F.tmp 2648 F47C.tmp 532 F4DA.tmp 1136 F538.tmp 1576 F5A5.tmp 2196 F602.tmp 1940 F641.tmp 1692 F67F.tmp 2176 F6BE.tmp 2088 F6FC.tmp 2952 F73A.tmp 1764 F779.tmp 1636 F7B7.tmp 688 F7F6.tmp 1312 F834.tmp 1828 F872.tmp 1628 F8B1.tmp 2412 F8EF.tmp 1608 F92E.tmp 372 F96C.tmp 1388 F9AA.tmp 1652 F9E9.tmp 1932 FA27.tmp 2396 FA66.tmp 1420 FAA4.tmp 1904 FAE2.tmp 2028 FB21.tmp 1368 FB5F.tmp 1084 FB9E.tmp 2332 FBDC.tmp 888 FC1A.tmp 2284 FC59.tmp 2344 FC97.tmp 1928 FCD6.tmp 1592 FD62.tmp 2384 FDB0.tmp 2740 FDEE.tmp 2956 FE2D.tmp 2784 FE6B.tmp 2680 FEAA.tmp 2664 FEE8.tmp 3016 FF26.tmp 2820 FF65.tmp 2712 FFA3.tmp 2564 FFE2.tmp 2592 30.tmp 2140 8D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2932 2024-08-08_38d52073fbc2f8d64d3f0d0ab70e6c13_mafia.exe 2084 ED2C.tmp 2676 ED8A.tmp 2756 EE07.tmp 2948 EE74.tmp 2736 EED2.tmp 2812 EF2F.tmp 2764 EF9C.tmp 2548 F00A.tmp 2668 F077.tmp 2360 F0D4.tmp 2432 F132.tmp 2892 F19F.tmp 1112 F20C.tmp 2856 F27A.tmp 2308 F2D7.tmp 268 F344.tmp 2288 F3B2.tmp 672 F41F.tmp 2648 F47C.tmp 532 F4DA.tmp 1136 F538.tmp 1576 F5A5.tmp 2196 F602.tmp 1940 F641.tmp 1692 F67F.tmp 2176 F6BE.tmp 2088 F6FC.tmp 2952 F73A.tmp 1764 F779.tmp 1636 F7B7.tmp 688 F7F6.tmp 1312 F834.tmp 1828 F872.tmp 1628 F8B1.tmp 2412 F8EF.tmp 1608 F92E.tmp 372 F96C.tmp 1388 F9AA.tmp 1652 F9E9.tmp 1932 FA27.tmp 2396 FA66.tmp 1420 FAA4.tmp 1904 FAE2.tmp 2028 FB21.tmp 1368 FB5F.tmp 1084 FB9E.tmp 2332 FBDC.tmp 888 FC1A.tmp 2284 FC59.tmp 2344 FC97.tmp 1584 FD14.tmp 1592 FD62.tmp 2384 FDB0.tmp 2740 FDEE.tmp 2956 FE2D.tmp 2784 FE6B.tmp 2680 FEAA.tmp 2664 FEE8.tmp 3016 FF26.tmp 2820 FF65.tmp 2712 FFA3.tmp 2564 FFE2.tmp 2592 30.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7697.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E743.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6623.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 753F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 141D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B664.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5734.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 474D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2084 2932 2024-08-08_38d52073fbc2f8d64d3f0d0ab70e6c13_mafia.exe 31 PID 2932 wrote to memory of 2084 2932 2024-08-08_38d52073fbc2f8d64d3f0d0ab70e6c13_mafia.exe 31 PID 2932 wrote to memory of 2084 2932 2024-08-08_38d52073fbc2f8d64d3f0d0ab70e6c13_mafia.exe 31 PID 2932 wrote to memory of 2084 2932 2024-08-08_38d52073fbc2f8d64d3f0d0ab70e6c13_mafia.exe 31 PID 2084 wrote to memory of 2676 2084 ED2C.tmp 32 PID 2084 wrote to memory of 2676 2084 ED2C.tmp 32 PID 2084 wrote to memory of 2676 2084 ED2C.tmp 32 PID 2084 wrote to memory of 2676 2084 ED2C.tmp 32 PID 2676 wrote to memory of 2756 2676 ED8A.tmp 33 PID 2676 wrote to memory of 2756 2676 ED8A.tmp 33 PID 2676 wrote to memory of 2756 2676 ED8A.tmp 33 PID 2676 wrote to memory of 2756 2676 ED8A.tmp 33 PID 2756 wrote to memory of 2948 2756 EE07.tmp 34 PID 2756 wrote to memory of 2948 2756 EE07.tmp 34 PID 2756 wrote to memory of 2948 2756 EE07.tmp 34 PID 2756 wrote to memory of 2948 2756 EE07.tmp 34 PID 2948 wrote to memory of 2736 2948 EE74.tmp 35 PID 2948 wrote to memory of 2736 2948 EE74.tmp 35 PID 2948 wrote to memory of 2736 2948 EE74.tmp 35 PID 2948 wrote to memory of 2736 2948 EE74.tmp 35 PID 2736 wrote to memory of 2812 2736 EED2.tmp 36 PID 2736 wrote to memory of 2812 2736 EED2.tmp 36 PID 2736 wrote to memory of 2812 2736 EED2.tmp 36 PID 2736 wrote to memory of 2812 2736 EED2.tmp 36 PID 2812 wrote to memory of 2764 2812 EF2F.tmp 37 PID 2812 wrote to memory of 2764 2812 EF2F.tmp 37 PID 2812 wrote to memory of 2764 2812 EF2F.tmp 37 PID 2812 wrote to memory of 2764 2812 EF2F.tmp 37 PID 2764 wrote to memory of 2548 2764 EF9C.tmp 38 PID 2764 wrote to memory of 2548 2764 EF9C.tmp 38 PID 2764 wrote to memory of 2548 2764 EF9C.tmp 38 PID 2764 wrote to memory of 2548 2764 EF9C.tmp 38 PID 2548 wrote to memory of 2668 2548 F00A.tmp 39 PID 2548 wrote to memory of 2668 2548 F00A.tmp 39 PID 2548 wrote to memory of 2668 2548 F00A.tmp 39 PID 2548 wrote to memory of 2668 2548 F00A.tmp 39 PID 2668 wrote to memory of 2360 2668 F077.tmp 40 PID 2668 wrote to memory of 2360 2668 F077.tmp 40 PID 2668 wrote to memory of 2360 2668 F077.tmp 40 PID 2668 wrote to memory of 2360 2668 F077.tmp 40 PID 2360 wrote to memory of 2432 2360 F0D4.tmp 41 PID 2360 wrote to memory of 2432 2360 F0D4.tmp 41 PID 2360 wrote to memory of 2432 2360 F0D4.tmp 41 PID 2360 wrote to memory of 2432 2360 F0D4.tmp 41 PID 2432 wrote to memory of 2892 2432 F132.tmp 42 PID 2432 wrote to memory of 2892 2432 F132.tmp 42 PID 2432 wrote to memory of 2892 2432 F132.tmp 42 PID 2432 wrote to memory of 2892 2432 F132.tmp 42 PID 2892 wrote to memory of 1112 2892 F19F.tmp 43 PID 2892 wrote to memory of 1112 2892 F19F.tmp 43 PID 2892 wrote to memory of 1112 2892 F19F.tmp 43 PID 2892 wrote to memory of 1112 2892 F19F.tmp 43 PID 1112 wrote to memory of 2856 1112 F20C.tmp 44 PID 1112 wrote to memory of 2856 1112 F20C.tmp 44 PID 1112 wrote to memory of 2856 1112 F20C.tmp 44 PID 1112 wrote to memory of 2856 1112 F20C.tmp 44 PID 2856 wrote to memory of 2308 2856 F27A.tmp 45 PID 2856 wrote to memory of 2308 2856 F27A.tmp 45 PID 2856 wrote to memory of 2308 2856 F27A.tmp 45 PID 2856 wrote to memory of 2308 2856 F27A.tmp 45 PID 2308 wrote to memory of 268 2308 F2D7.tmp 46 PID 2308 wrote to memory of 268 2308 F2D7.tmp 46 PID 2308 wrote to memory of 268 2308 F2D7.tmp 46 PID 2308 wrote to memory of 268 2308 F2D7.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-08_38d52073fbc2f8d64d3f0d0ab70e6c13_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-08_38d52073fbc2f8d64d3f0d0ab70e6c13_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\ED2C.tmp"C:\Users\Admin\AppData\Local\Temp\ED2C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\EE07.tmp"C:\Users\Admin\AppData\Local\Temp\EE07.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\EE74.tmp"C:\Users\Admin\AppData\Local\Temp\EE74.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\EED2.tmp"C:\Users\Admin\AppData\Local\Temp\EED2.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\F00A.tmp"C:\Users\Admin\AppData\Local\Temp\F00A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\F077.tmp"C:\Users\Admin\AppData\Local\Temp\F077.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\F132.tmp"C:\Users\Admin\AppData\Local\Temp\F132.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\F19F.tmp"C:\Users\Admin\AppData\Local\Temp\F19F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\F27A.tmp"C:\Users\Admin\AppData\Local\Temp\F27A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\F47C.tmp"C:\Users\Admin\AppData\Local\Temp\F47C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\F602.tmp"C:\Users\Admin\AppData\Local\Temp\F602.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\F641.tmp"C:\Users\Admin\AppData\Local\Temp\F641.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\F67F.tmp"C:\Users\Admin\AppData\Local\Temp\F67F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\F6FC.tmp"C:\Users\Admin\AppData\Local\Temp\F6FC.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\F73A.tmp"C:\Users\Admin\AppData\Local\Temp\F73A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\F779.tmp"C:\Users\Admin\AppData\Local\Temp\F779.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Users\Admin\AppData\Local\Temp\F834.tmp"C:\Users\Admin\AppData\Local\Temp\F834.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\F872.tmp"C:\Users\Admin\AppData\Local\Temp\F872.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\F8B1.tmp"C:\Users\Admin\AppData\Local\Temp\F8B1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\F8EF.tmp"C:\Users\Admin\AppData\Local\Temp\F8EF.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\F92E.tmp"C:\Users\Admin\AppData\Local\Temp\F92E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\F96C.tmp"C:\Users\Admin\AppData\Local\Temp\F96C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:372 -
C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\FA27.tmp"C:\Users\Admin\AppData\Local\Temp\FA27.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\FA66.tmp"C:\Users\Admin\AppData\Local\Temp\FA66.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\FB21.tmp"C:\Users\Admin\AppData\Local\Temp\FB21.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\FB5F.tmp"C:\Users\Admin\AppData\Local\Temp\FB5F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\FB9E.tmp"C:\Users\Admin\AppData\Local\Temp\FB9E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\FC59.tmp"C:\Users\Admin\AppData\Local\Temp\FC59.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\FC97.tmp"C:\Users\Admin\AppData\Local\Temp\FC97.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"52⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\FD14.tmp"C:\Users\Admin\AppData\Local\Temp\FD14.tmp"53⤵
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\FD62.tmp"C:\Users\Admin\AppData\Local\Temp\FD62.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\FE2D.tmp"C:\Users\Admin\AppData\Local\Temp\FE2D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\FF65.tmp"C:\Users\Admin\AppData\Local\Temp\FF65.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\8D.tmp"C:\Users\Admin\AppData\Local\Temp\8D.tmp"66⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\DB.tmp"C:\Users\Admin\AppData\Local\Temp\DB.tmp"67⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\11A.tmp"C:\Users\Admin\AppData\Local\Temp\11A.tmp"68⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\158.tmp"C:\Users\Admin\AppData\Local\Temp\158.tmp"69⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\196.tmp"C:\Users\Admin\AppData\Local\Temp\196.tmp"70⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\1D5.tmp"C:\Users\Admin\AppData\Local\Temp\1D5.tmp"71⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\213.tmp"C:\Users\Admin\AppData\Local\Temp\213.tmp"72⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\252.tmp"C:\Users\Admin\AppData\Local\Temp\252.tmp"73⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\290.tmp"C:\Users\Admin\AppData\Local\Temp\290.tmp"74⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\2CE.tmp"C:\Users\Admin\AppData\Local\Temp\2CE.tmp"75⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\30D.tmp"C:\Users\Admin\AppData\Local\Temp\30D.tmp"76⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\34B.tmp"C:\Users\Admin\AppData\Local\Temp\34B.tmp"77⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\38A.tmp"C:\Users\Admin\AppData\Local\Temp\38A.tmp"78⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3C8.tmp"C:\Users\Admin\AppData\Local\Temp\3C8.tmp"79⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\406.tmp"C:\Users\Admin\AppData\Local\Temp\406.tmp"80⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\454.tmp"C:\Users\Admin\AppData\Local\Temp\454.tmp"81⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\493.tmp"C:\Users\Admin\AppData\Local\Temp\493.tmp"82⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\4D1.tmp"C:\Users\Admin\AppData\Local\Temp\4D1.tmp"83⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\510.tmp"C:\Users\Admin\AppData\Local\Temp\510.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\54E.tmp"C:\Users\Admin\AppData\Local\Temp\54E.tmp"85⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\58C.tmp"C:\Users\Admin\AppData\Local\Temp\58C.tmp"86⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\5CB.tmp"C:\Users\Admin\AppData\Local\Temp\5CB.tmp"87⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\609.tmp"C:\Users\Admin\AppData\Local\Temp\609.tmp"88⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\648.tmp"C:\Users\Admin\AppData\Local\Temp\648.tmp"89⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\686.tmp"C:\Users\Admin\AppData\Local\Temp\686.tmp"90⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\6C4.tmp"C:\Users\Admin\AppData\Local\Temp\6C4.tmp"91⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\703.tmp"C:\Users\Admin\AppData\Local\Temp\703.tmp"92⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\741.tmp"C:\Users\Admin\AppData\Local\Temp\741.tmp"93⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\780.tmp"C:\Users\Admin\AppData\Local\Temp\780.tmp"94⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\7BE.tmp"C:\Users\Admin\AppData\Local\Temp\7BE.tmp"95⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\7FC.tmp"C:\Users\Admin\AppData\Local\Temp\7FC.tmp"96⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\83B.tmp"C:\Users\Admin\AppData\Local\Temp\83B.tmp"97⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\879.tmp"C:\Users\Admin\AppData\Local\Temp\879.tmp"98⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\8B8.tmp"C:\Users\Admin\AppData\Local\Temp\8B8.tmp"99⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\8F6.tmp"C:\Users\Admin\AppData\Local\Temp\8F6.tmp"100⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\934.tmp"C:\Users\Admin\AppData\Local\Temp\934.tmp"101⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\973.tmp"C:\Users\Admin\AppData\Local\Temp\973.tmp"102⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\9B1.tmp"C:\Users\Admin\AppData\Local\Temp\9B1.tmp"103⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\9F0.tmp"C:\Users\Admin\AppData\Local\Temp\9F0.tmp"104⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\A2E.tmp"C:\Users\Admin\AppData\Local\Temp\A2E.tmp"105⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\A6C.tmp"C:\Users\Admin\AppData\Local\Temp\A6C.tmp"106⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\ABA.tmp"C:\Users\Admin\AppData\Local\Temp\ABA.tmp"107⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\AF9.tmp"C:\Users\Admin\AppData\Local\Temp\AF9.tmp"108⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\B37.tmp"C:\Users\Admin\AppData\Local\Temp\B37.tmp"109⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"110⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\BB4.tmp"C:\Users\Admin\AppData\Local\Temp\BB4.tmp"111⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"112⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\C31.tmp"C:\Users\Admin\AppData\Local\Temp\C31.tmp"113⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"114⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\CAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAE.tmp"115⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"116⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"117⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"118⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"119⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"120⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"121⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"122⤵PID:2420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-